Follow the latest coverage, related explainers and connected technology stories.
Microsoft is tracking campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek, and Claude to steal payment data and credentials and distribute malware. The article calls for correlating email, identity, device, and cloud application signals to detect and disrupt attacks before they become broader breaches.
Microsoft Defender Experts tracked an active campaign impersonating software vendor websites to distribute malicious installers that regenerate themselves with every download, then establish persistence mechanisms, weaken Windows protection, and attempt to connect to attacker-controlled infrastructure. The observed activity focuses on China-linked operations and Chinese-speaking users, with infections in the healthcare, manufacturing, gaming, technology, government, and education sectors.